only store partial hash in cookies for validation